Vulnerability in Kernel Package: blk-iolatency
Summary
GSD-2022-1003713: blk-iolatency: Fix inflight count imbalances and IO hangs on offline. Affects Kernel versions >= 8c772a9bfc7c07c76f4a58b58910452fbb20843b, < d19fa8f252000d141f9199ca32959c50314e1f05. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel package is a critical component of the Linux operating system, responsible for managing the system's core functionality. It provides essential services such as memory management, process scheduling, and device drivers. The blk-iolatency module within the Kernel package focuses on controlling the latency of block I/O operations. It aims to limit the impact of I/O operations on system performance. However, a vulnerability has been discovered in this module that can lead to imbalances in the inflight count and cause I/O hangs when a device is offline.
Vulnerability Detail
The vulnerability in blk-iolatency arises from a flaw introduced in version v5.0 of the Linux Kernel by commit 8c772a9bfc7c07c76f4a58b58910452fbb20843b. It affects subsequent versions until it was fixed in v5.4.198 by commit d19fa8f252000d141f9199ca32959c50314e1f05. When a device managed by blk-iolatency goes offline, it can result in imbalances in the inflight count, causing I/O operations to hang indefinitely. This vulnerability can potentially impact system performance and stability, leading to service disruptions and delays in I/O operations.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
No workaround has been provided for this vulnerability. It is essential to apply the recommended fix by updating the Kernel package to the patched version.
Conclusion
The vulnerability in the Kernel package's blk-iolatency module can lead to imbalances in the inflight count and I/O hangs when a device goes offline. To mitigate this issue, it is crucial to update the Kernel package to version v5.4.198 or later. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The Kernel package is a fundamental component of the Linux operating system, responsible for managing core system functionality.
blk-iolatency is a module within the Kernel package that focuses on controlling the latency of block I/O operations.
This vulnerability can lead to imbalances in the inflight count and cause I/O hangs when a device managed by blk-iolatency goes offline. This can result in degraded system performance and delays in I/O operations.
The vulnerability was introduced in version v5.0 of the Linux Kernel and affects subsequent versions until it was fixed in v5.4.198.
To fix this vulnerability, update the Linux Kernel package to version v5.4.198 or later, which includes the necessary fix for the blk-iolatency module.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
